Merge pull request #440 from pq-code-package/clang21

Add clang 21 to compiler and constant-time tests

Author: hanno-becker

.github/workflows/ci.yml

@@ -219,6 +219,13 @@ jobs:
            c23: True
            opt: all
            examples: False
+         - name: clang-21
+           shell: ci_clang21
+           darwin: True
+           c17: True
+           c23: True
+           opt: all
+           examples: False
          # CPU flags are not correctly passed to the zig assembler
          # https://github.com/ziglang/zig/issues/23576
          # We therefore only test the C backend

.github/workflows/ct-tests.yml

@@ -28,6 +28,7 @@ jobs:
           - ci_valgrind-varlat_clang18
           - ci_valgrind-varlat_clang19
           - ci_valgrind-varlat_clang20
+          - ci_valgrind-varlat_clang21
           - ci_valgrind-varlat_gcc48
           - ci_valgrind-varlat_gcc49
           - ci_valgrind-varlat_gcc7
@@ -64,7 +65,7 @@ jobs:
           valgrind_flags: --variable-latency-errors=yes
       - name:  Build and run test (-Ofast)
         # -Ofast got deprecated in clang19; -O3 -ffast-math should be used instead
-        if: ${{ matrix.nix-shell != 'ci_valgrind-varlat_clang19' &&  matrix.nix-shell !=  'ci_valgrind-varlat_clang20' }}
+        if: ${{ matrix.nix-shell != 'ci_valgrind-varlat_clang19' &&  matrix.nix-shell !=  'ci_valgrind-varlat_clang20' && matrix.nix-shell !=  'ci_valgrind-varlat_clang21'}}
         uses: ./.github/actions/ct-test
         with:
           cflags: -Ofast -DMLD_CONFIG_KEYGEN_PCT

.github/workflows/nix.yml

@@ -88,12 +88,15 @@ jobs:
       fail-fast: false
       matrix:
         target:
+          # nixpkgs requires 2.18 since August 2025, see 
+          # https://github.com/NixOS/nixpkgs/pull/428076
+          # TODO: Re-enable tests on Ubuntu 22 once nix has been updated to >= 2.18
+          # - runner: ubuntu-22.04
+          #   container:
+          #   install: 'apt'
           - runner: ubuntu-latest
-            container: nixos/nix:2.6.1
+            container: nixos/nix:2.18.0
             install: 'native'
-          - runner: ubuntu-22.04
-            container:
-            install: 'apt'
           - runner: ubuntu-24.04
             container:
             install: 'apt'

CONTRIBUTING.md

@@ -9,7 +9,7 @@ any of the open issues. Here are some things to get you started.
 
 We specify the development environment for mldsa-native using `nix`. If you want to help develop mldsa-native, please
 use `nix`. We recommend using the latest Nix version provided by the [nix installer
-script](https://nixos.org/download/), but we currently support all Nix versions >= 2.6.
+script](https://nixos.org/download/), but we currently support all Nix versions >= 2.18.
 
 All the development and build dependencies are specified in [flake.nix](flake.nix). To execute a bash shell, run
 ```bash

flake.lock

@@ -52,6 +52,7 @@
                 gcc48 = pkgs-2405.gcc48;
                 gcc49 = pkgs-2405.gcc49;
                 gcc7 = pkgs-2405.gcc7;
+                clang_21 = pkgs-unstable.clang_21;
               })
             ];
           };
@@ -106,6 +107,7 @@
           devShells.ci_clang18 = util.mkShellWithCC' pkgs.clang_18;
           devShells.ci_clang19 = util.mkShellWithCC' pkgs.clang_19;
           devShells.ci_clang20 = util.mkShellWithCC' pkgs.clang_20;
+          devShells.ci_clang21 = util.mkShellWithCC' pkgs.clang_21;
 
           devShells.ci_zig0_12 = util.mkShellWithCC' (zigWrapCC pkgs.zig_0_12);
           devShells.ci_zig0_13 = util.mkShellWithCC' (zigWrapCC pkgs.zig_0_13);
@@ -128,6 +130,7 @@
           devShells.ci_valgrind-varlat_clang18 = util.mkShellWithCC_valgrind' pkgs.clang_18;
           devShells.ci_valgrind-varlat_clang19 = util.mkShellWithCC_valgrind' pkgs.clang_19;
           devShells.ci_valgrind-varlat_clang20 = util.mkShellWithCC_valgrind' pkgs.clang_20;
+          devShells.ci_valgrind-varlat_clang21 = util.mkShellWithCC_valgrind' pkgs.clang_21;
           devShells.ci_valgrind-varlat_gcc48 = util.mkShellWithCC_valgrind' pkgs.gcc48;
           devShells.ci_valgrind-varlat_gcc49 = util.mkShellWithCC_valgrind' pkgs.gcc49;
           devShells.ci_valgrind-varlat_gcc7 = util.mkShellWithCC_valgrind' pkgs.gcc7;